Privacy Policy

We may collect personal information that you voluntarily provide to us, including but not limited to:

• Name
• Email address
• Phone number
• Company, role, and billing information
• Account information and usage data

Information collected from third-party platforms

When customers connect external accounts to FullFloe.ai — including Meta (Facebook / Instagram), Google, LinkedIn, X, TikTok, Twilio, Stripe, Calendly, HubSpot, Apollo, and Smartlead — we access and process data via each provider's APIs to deliver our automated messaging, ad, calendar, phone, payments, and CRM features. This "End-User Data" may include:

• Messaging content: text, media, and timestamps of direct messages sent to our customers' connected accounts.
• Profile metadata: basic public profile information about the people interacting with our customers, such as social handle, name, and profile picture URL.
• Engagement data: comments, story replies, ad performance metrics, and mentions on connected accounts.
• Ad, calendar, and CRM data: campaign metrics, event bookings, contact records, and pipeline updates from connected providers.

Note on media files: media received via connected messaging providers is processed in real-time and rendered directly via each provider's content delivery networks, in compliance with their developer data use policies. We do not permanently store media files on our servers unless the customer explicitly uploads or attaches them.

We use the information we collect to provide, maintain, and improve our services. Specifically regarding SMS and phone verification, we use your phone number to:

• Send login verification codes (2FA) and security alerts.
• Provide customer support and respond to inquiries.
• Send service updates, account notifications, and billing alerts.
• Communicate with you regarding your use of the FullFloe.ai platform.

Processing of end-user data

We act as a Data Processor for End-User Data collected from connected third-party platforms. We process this data strictly to:

• Operate AI agents that automatically read, route, and respond to messages, comments, and inbound leads on behalf of our customers.
• Provide our customers with a secure dashboard to view conversation history, campaign performance, and pipeline data.
• Generate reports, meeting notes, and market research on behalf of customers.

We do not use End-User Data derived from connected platforms for our own marketing, we do not sell or share it with third-party advertisers, and we do not use customer lead data to train our general-purpose AI models.

We respect your privacy. We do not sell, rent, loan, trade, or lease any personal information collected, including phone numbers, to any third party.

SMS consent and phone numbers: no mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We may share information with trusted third-party service providers (such as SMS delivery, hosting, payments, and analytics platforms) strictly for the purpose of delivering our services to you. These providers are contractually obligated to keep your information confidential and use it only for the purposes for which we disclose it to them.

We implement a variety of security measures — including encryption in transit, workspace-scoped row-level security, token-based access controls, and least-privilege access to production data — to maintain the safety of your personal information. However, no method of transmission over the internet or method of electronic storage is 100% secure.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

• Account data: retained for the duration of your active account, plus up to 30 days after account closure for backup and recovery.
• Connected-platform end-user data: message content and conversation history are retained for as long as our customer maintains an active account, or until the end-user or customer requests deletion.
• Signed documents and audit trails: retained for the life of the workspace, or up to 7 years after signing where required by law.
• Billing and transaction records: retained for up to 7 years as required by applicable tax and accounting laws.
• Analytics data: aggregated, anonymized analytics may be retained indefinitely for service improvement purposes.

Upon request for data deletion, we will remove your personal data within 30 days, except where retention is required by law.

If you are an end-user who has interacted with an FullFloe.ai-powered AI agent via a customer's connected account and you wish to have your data removed from our systems, you have the right to request full data deletion by emailing privacy@orbit.app. Customers can request deletion of their workspace data at any time from Settings, or by contacting support.

FullFloe.ai is operated from the United States. If you are accessing our services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located.

By using our services, you consent to the transfer of your information to the United States. We take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Policy and applicable data protection laws, including GDPR for users in the European Economic Area.

We use trusted third-party service providers to help us operate our platform. These providers have access to your personal information only to perform specific tasks on our behalf and are obligated to protect your data. Our key service providers include:

• Cloud infrastructure: for secure data storage and application hosting.
• Meta Platforms (Facebook / Instagram): for messaging and engagement data via the Graph API.
• Google, LinkedIn, X, TikTok: for ad delivery, audience insights, and social publishing.
• Twilio: for SMS delivery, phone verification, and calls.
• Stripe: for secure handling of billing and subscription payments.
• Calendly: for scheduling integrations.
• Apollo & Smartlead: for prospecting and cold email delivery.
• AI providers (OpenAI, Anthropic, Google) via the Lovable AI Gateway: for large-language-model inference powering AI agents, copilots and content generation. Prompts and responses are processed under each provider's zero-retention or short-retention terms; we do not permit training on customer data.
• Analytics services: for understanding platform usage and improving our services.

We do not sell your personal information to any third parties. A full, up-to-date list of sub-processors is maintained at /subprocessors.

We use cookies and similar tracking technologies to enhance your experience on our platform. Essential cookies keep you signed in and preserve your workspace settings. Analytics and marketing cookies are only set with your consent, which you can give, refuse or change at any time through the cookie banner shown on your first visit. EU/UK visitors are asked to opt in before any non-essential cookies are set.

If you are a California resident, you have the right to know what personal information we collect, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information as those terms are defined under the CCPA/CPRA. FullFloe.ai does not sell personal information for money and does not share personal information for cross-context behavioral advertising. To exercise these rights, or to submit a "Do Not Sell or Share My Personal Information" request, email privacy@fullfloe.ai.

For users in the EEA / UK, we rely on the following legal bases: performance of a contract (to provide the service you signed up for), legitimate interests (to secure, improve and support the service), consent (for non-essential cookies and optional marketing communications), and legal obligation (for tax, accounting and compliance records). You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to lodge a complaint with your local supervisory authority. Where personal data is transferred outside the EEA/UK we rely on the EU Standard Contractual Clauses and, where applicable, the UK IDTA. See /dpa.

FullFloe.ai is not intended for use by children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If we become aware that we have inadvertently collected personal data from a child under the applicable age, we will take steps to delete such information as soon as possible. If you believe that a child has provided us with their personal information, please contact us immediately at privacy@orbit.app.

If you have any questions regarding this Privacy Policy, please contact us at:

FullFloe.ai Labs Inc.
A Delaware Corporation
privacy@orbit.app